Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
145 detections
Filters
Last updated
All Time
Detection languages
86
27
13
10
7
Contributors
26
20
15
12
9
Categories
78
60
32
22
21
Platforms
44
41
24
23
17
Products / Services
26
16
15
14
13
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
6
5
5
5
4
IDS Classtypes
1
1
IDS Protocols
1
Prior to deploying Macaw ransomware in an organization, adversaries will change the password for hundreds or thousands of accounts in order to lock users out of the network and impeded recovery efforts.
User accounts may be created to achieve persistence on a machine.
Read more here: https://attack.mitre.org/wiki/Technique/T1136.
Tags: #CreateAccount.
Query #1: Query for users being created using "net user" command.
"net user" commands are noisy, so needs to be joined with another signal -.
E.g. in this example we look for use of uncommon & undocumented commandline switches (e.g. /ad instead of /add).
Read more here: https://attack.mitre.org/wiki/Technique/T1136.
Tags: #CreateAccount.
Query #1: Query for users being created using "net user" command.
"net user" commands are noisy, so needs to be joined with another signal -.
E.g. in this example we look for use of uncommon & undocumented commandline switches (e.g. /ad instead of /add).
'This hunting query identifies a user that add/invite a member to the organization for the first time. This technique can be leveraged by attackers to add stealth account access to the organization.'
'This hunting query identifies Accounts that are new or inactive and have accessed or used GitHub that may be a sign of compromise.'
This query checks for attempts to stop at least 10 separate processes using the net stop command. Run query
Search for the creation of a new user using a known DEV-0270 username/password schema.
This rule detects a sequence of events indicating the creation of a user account, a successful login by that user, and the subsequent deletion of the same user account within a 4-hour timeframe. This pattern is often indicative of an adversary creating temporary accounts for malicious activities, using them, and then removing them to cover their tracks or evade detection. The rule specifically targets Windows login events (event code 4624).
Detects the creation of a new user account on an ESXi system using the 'esxcli' command-line interface. This activity can be an indicator of an adversary establishing persistence or gaining unauthorized access to the hypervisor.
Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.
Detects the creation, login, and deletion of a user account over a predefined timeframe
Detects user account creation on ESXi system via esxcli
Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.
The analytic detects the creation of new user accounts on Linux systems using commands like "useradd" or "adduser." It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries often create new user accounts to establish persistence on compromised hosts. If confirmed malicious, this could allow attackers to maintain access, escalate privileges, and further compromise the system, posing a severe security risk.
Detects when a group is attempted to be created but fails in Office 365. This could be due to insufficient permissions or other errors
Detect when free Google Email addressess are added to IAM Policy such as gmail.com, googlemail.com or googlegroups.com.
Detect when a user creates a new access key for another user and escalates privileges using this newly created access key from the same IP.
Detect when a user creates or updates a login profile for another user and escalates privileges using this new user from the same IP.
Detects when an AWS ElastiCache security group has been created. This action can be used by adversaries to establish persistence or modify network access to ElastiCache resources.
Detects when an ElastiCache security group has been created.
Page 7 of 7